Assurance IT invited Security Engineer Manager, Mark Salinas, to chat about the evolution of cyber security.

In this episode, Mark Salinas and co-founder of Assurance IT, Luigi Tiano, discuss: 

1. Evolution of networking
2. Cyber security in 2000 vs 2022
3. End-users in 2000 vs 2022
4. The reality of buying cyber security tools
5. Cyber security vs cyber resilience
6. Cyber attacks on critical infrastructure
7. Getting hacked through a clock
8. What the Googles of the world are doing to mitigate the skillset shortage in IT

Resources: 

Watch the episode: https://youtu.be/TUA01zTVbw0

Mark Salinas' LinkedIn: https://www.linkedin.com/in/mark-salinas-75b9363/

Luigi Tiano’s LinkedIn: https://www.linkedin.com/in/luigitiano/

Assurance IT Website: http://www.assuranceit.ca/

About Mark Salinas: 

Over 20 years industry experience as a security & network architect and engineer, including: design & installation of: networking, Cloud, Network Security, Firewalls, IDS/IPS, Application Security /Firewall, Application Acceleration, WAN Optimization. WAF and DAM. Cloud Services. PCI & NERC Compliance and GRC. CISSP. Pre-Sales as well as Post Sales Support. Network & Security Architecture designs. Security Audits & reviews. US citizen. Mentor.

About 10 Questions to Cyber Resilience: 

Twice per month, learn about how IT leaders are strengthening their cyber security practices. Every episode comprises of 10 questions that get you one step closer to cyber resilience. Subscribe to stay up-to-date with hot topics in cyber security. 

About Assurance IT: 

Assurance IT (www.assuranceit.ca) specializes in data protection and data privacy for the mid-market in Canada, since 2011. The Montreal-based company’s unique approach to helping customers become cyber resilient is called the PPR Methodology which stands for Prepare, Protect and Recover. Based on industry best practices, the PPR Methodology is an easier way to achieve cyber security and compliance objectives.

This is 10

questions to cyber resilience

brought to you by assurance

it released twice per month.

Every episode brings you one

step closer to cyber resilience

by hearing how it leaders are

practicing cyber security.

Resources mentioned in the episode

can be found in the show notes.

If you are ready to take your

cyber resilience to the next

level, be sure to subscribe so

you can catch every episode.

Tell us a

little bit about yourself,

who you are and what you do.

Sure.

My name's Mark.

I'm a cyber security, depending

on the day of the week, you

know, the time of the day

architect, engineer, manager,

any, all of those things.

I started in networking.

I was young, hungry and maybe

not bright in that, you know,

people would ask me to do stuff

and I'd say, yes, my natural

inclination at the time was

to say yes to everything.

So people would say,

Hey, I wanna network.

And I'd say yes.

And then I'd say, all right,

like how are we gonna do that?

So I started networking and

then because of the progression

of networking and layer three

firewalls, typically the

network of people were selected

to be the firewall experts.

Because again, the

layer three knowledge.

I just remember my boss, her

name was Kim said, I'm gonna

send you to firewall school.

And I said, sure, again, I

wanna say yes to everything.

And so I have to find

her and thank her.

So I've been in firewalls

since 2000 and it's just

been a natural progression of

firewalls to wa to

host, to network.

And it's all, it's just

a natural progression.

This latest job I decided I

was tired of telling people

they were doing it wrong and

jump into the fire myself.

Show 'em how it's done.

Good news is I'm doing it.

The bad news is it's

harder than it looks on TV.

So it's a challenge.

It's exciting.

Sometimes it's exciting,

like a roller coaster.

Sometimes it's exciting

like the house is on fire.

So not a good kind of exciting,

but every day is interesting.

yeah, I know.

I can appreciate that.

It's great.

And you mentioned like, the

networking professional, right?

So I guess inherently 15, 20

years ago, if you were in the

networking world, especially when

talking in touching firewalls

in the perimeter, you by default

became the security expert, right.

There was really no notion

of actually having a

security team at that time.

Right.

It was just securing the perimeter.

In fact, it

was usually, Hey, you network

guys here you're running the

firewalls and the network people.

Yeah.

Port IPs ports.

Sure.

That was a natural progression.

So I still think it's a

good natural progression.

There's still more obviously,

as you know, but it is

a natural progression.

I prefer to see kind

of an evolution.

Everybody wants to snap

their fingers and be a

cybersecurity expert or hire

one, but it's a progression.

You're not gonna know

everything day one.

So great way to start is

PCs, networking, layer

three, work your way up.

Yep.

I agree.

Can't agree more and in terms

of size of companies that

you worked for I mean, I've

looked at your profile and

I've seen what you've done.

You've worked for some rather

larger organizations, right?

Tell us a little bit about the

sizes that you've gone through

over the years, and where do

you feel the most comfortable?

Where you can provide

the most value?

That's

actually a great question.

I've done well in the telcos.

The telcos typically are very

strong in their networking,

not necessarily IP networking

or not necessarily security.

So I always was very

successful at the telcos.

Typically the customers

that need help as let's say

the fortune 1000 of 2000.

So I've done well in mid to

large fortune 100 fortune 10.

You know, those guys are

Jamie diamond is rumored

to have like a thousand or

10,000 people in security.

So they're not gonna need

a lot of help, but the

midsize couple fortune 1000

they're gonna need some help.

Yeah.

And so that's

where I've done well.

They're doing things, you

know, and they still need help.

And so I've been successful there.

Interesting.

Thank you for sharing that.

So without dating both of ourselves

here I'd like to talk a little bit

about how protecting the enterprise

has evolved over the years.

I think you touched a little bit

upon it earlier when you mentioned,

being close to the networking

aspect, but how do you see that

change happen over the years?

There's definitely been

a change and how has it

evolved in your opinion?

Yeah, absolutely.

It started, it's funny from a let's

skip protecting for two seconds.

Networking's gone the full circle.

We had main one mainframe at

headquarters and we went full

distributed computing, and now

we're going back to a big host.

Not a mainframe God forbid, but a

big host running in a data center.

So we're back to where we started.

The part that's

hard is, it was easy

protecting one mainframe or

your web presence, because you

knew what your tax surface was.

The key buzzword to everybody

should be a tax surface.

You have to know your tax surface.

So back when web, and when

eCommerce took off, you had

one or two, imagine an Amazon.

You have one server, amazon.com

protect the daylights out of it.

And yeah, everybody was hacking

amazon.com to get free stuff or

steal money or things like that.

So it went from, let me

protect one site or one

data center or one thing.

To now with malware, the

goal is to take over a PC.

And so now I gotta go from

protecting 1, 2, 10 servers

to 2000, 10,000 endpoints.

And 99%

isn't good enough.

If you have 1% of your PCs

vulnerable in that 1% gets

malware, you're stuck.

You're in a bad place.

And so it's gotten harder

in that I have to know

where every single PC is.

It's gotten harder because, I was

originally for compliance for, for

servers, it's a hundred percent.

I have to be 100% patched.

For PCs I was like, you know

what, with the executives and

traveling, let's shoot for 95%.

95% isn't good enough.

It's not good enough.

Yeah.

And at college,

they get you a good a but in

the real world, that just means

95% of a thousand is what?

50.

So 50 PCs are vulnerable.

So pray that those 50 PCs don't

get attacked and that's so

the

cliche says, right.

You're as strong as

your weakest link.

If you've got one weak link

in the chain there, which

could be any PC that's

vulnerable, then you're done.

Right.

So yeah, there's no room for error.

There's no margin error.

That's sure when it comes to

protecting enterprise and the

end point you mentioned it.

I think the endpoint is extremely,

it was overlooked, right?

You said it's kind of evolved.

Right.

And an endpoint also now

means having a mobile

device in your possession.

So that also has to

be protected as well.

Yeah.

And I'm glad you brought that up.

This whole MDM mobile device

management and bring your own

device like, oh, at least,

you know, when you have a

corporate image, it's our device.

This is the image I am security.

I am responsible for the

PC on your desk, Luigi

Right.

Now.

It's oh yeah.

Luigi, you bring your own device.

Like, what are you kidding me?

what's on your device?

Do I even know?

Exactly, exactly.

And where does that

device come from?

Who's had it?

You know, sometimes people buy

devices, like they'll buy them

online and they'll reuse them.

And so on.

It's such a tough situation to be

in when you're managing a bunch of

devices from whomever, and yeah,

the job has been has obviously

become more difficult for everyone.

So

yeah.

That kind of leads me

to my question about cybersecurity.

We use this word, listen,

it's, it's not a buzzword,

it's an actual thing, but yeah.

So what does

cybersecurity mean to you?

What did it mean in 2000, right.

Let's go back.

What does it mean in 2000 versus

what cybersecurity is in 2022?

What's your opinion then?

Sure.

Yeah, no, it's gotten better

and it's gotten worse.

So 2000 I had my web servers,

I had to protect, we had

firewalls, so I have one firewall

per data center, a handful of

rules, a handful of servers.

If people went home, they

dialed in, literally dialed in.

Yep.

And then you went

through the corporate network.

So your traffic came back

to corporate got secure,

went back out again.

These days with cloud, everyone

wants to do everything everywhere.

So I've got my laptop and I wanna

do everything in a Starbucks.

Okay.

We have things for that.

There's cloud security, cloud

proxies and that's all well and

good, but it still comes down to,

the IT guys, the IT department,

the IT security department has

to say, okay, every PC has the

appropriate software so that

when you go out to, to your

Starbucks in, You know, east of

PIP, Idaho that you're protected

and there's tools for that.

But again, it's back to that a

hundred percent and I have to

make sure every tool is up to

date in terms of all the clients.

Every PC I'm sorry

Right.

And you made me think

about something right now.

So cybersecurity again

in 2000 versus 2022.

I mean the end user,

what does that look like?

I remember my first

job before 2000.

I was kind of just an enterprise

there and security was not

even a thing that we thought

about, to be honest with you.

Now let's just be honest, right?

So now security is like day one,

any job orientation, that's kind

of like they're pounding in.

So against the culture

shift, I think.

Right?

So what did you see in

terms of your end users in

2020 or 2000 versus now?

Have you seen that shift happen?

Is it real thing where

people are more cognizant?

That's

two different questions.

You're right.

People

are getting training.

Years ago,

it was, don't leave your

laptop in your backseat.

Security man.

Don't leave your laptop

in your backseat.

Be careful going through

airport security.

There's rules around security

were very, just common sense.

Don't do something really dumb.

Yes.

Now it's, you

know, watch out for this.

Watch out for that.

I wanna go down, I guess

now is as good time as any.

You and I corporates training

users, there is now most

companies onboarding, you get

a full hour of IT security

training, one to three hours.

And that's fantastic.

But when I have conversations

with people, so two

things are happening.

One users are getting trained.

Yes.

Yep.

Two users are aware.

If you call someone up and say,

Hey I think we have a problem.

They go, oh yeah, I get it.

They'll spout you.

This is what don't do these things.

Mm-hmm I go, great.

You get it.

And then when I look at

my inbox and everyone is

forwarding me, their spam

saying, is this phishing?

And I'm like, It's free Viagra.

Like really?

like, you know, people

are forwarding me.

I'm 91% of the, I think this is

phishing report phishing button

is not phishing so the 91%.

And it's really,

you just look at it.

It's free Walmart gift cards.

I mean, come on guys.

So.

There's a disconnect between

what people are saying and what

they're clicking and either,

well, first it brings me, I

guess, to my next point, I

don't mean to go off your path.

Sorry.

No, no.

All

people are scared.

First and foremost,

people are scared.

Executives that I don't think

should be scared and normal

users, end users, somebody, an

accountant and account managers.

And we don't expect

them to be savy.

They're scared.

We put the fear God in

them and that's okay.

I'm kind of glad to be honest, but

they're not doing the right thing.

So scaring someone into doing

the right thing is not working.

Second.

That's interesting.

That's interesting point.

Yeah.

We've scared

them and now they forward

me all their emails.

To say, Hey, Mark is this phishing?

Is this phishing is,

oh, for the love of God.

Like, this is not

all, this is spam.

This is, you know?

There's

differentiation there.

Yeah.

There's a big,

that spam is at this point.

Anyone older than the age of five

should know spam, come on, right?

Yep.

Because

we get so much of it.

But it's the part that's throwing

me is executives the boards.

I wrote this in my

column and you jumped in.

I appreciate it.

If you go in front of the board

and say, I need money for cyber

security, the boards gonna say

yes, and I am like, awesome.

That's a great thing for business.

So the board says, go spend some

money, but then the executives are

like, so I bought a whole bunch

of tools and I'm like, okay, what

are you doing with those tools?

And they're like watching

security and I'm like, I need a

little better answer than that.

Right.

And so.

As I write, these tools need

to be managed when I was

doing this role, I was like,

let's go buy some tools.

And then, you know, added

four hours to my day.

Maybe I'm not getting

the best viewpoint here.

So we need to be selective

about the tools and if

we buy tools, we need to

really use the tool.

I'm hung up on a database

activity monitoring.

People are buying it and when

I look at how they're using it,

database activity monitoring

is an incredible tool, but you

need the database person sitting

next to you because I don't know

what the database looks like.

And so here's this expensive

tools creating these reports

that no one knows how to read.

And I'm like this is not good.

So it's business needs to take

a breath and every time you do

something, say, I bought something.

Okay.

What are you gonna do with it?

What's the purpose.

Yeah.

Before buying it before buying it.

Right?

Like understand it's objective.

Understand what value you're

looking to derive from it.

Right.

That's a very good, valid point.

I like that because.

Again, and this is just my opinion.

And I'm talking to a lot of

professional like yourself about

it, and I'm trying to distinguish

between what cybersecurity is

and what cyber resilience is.

And I know, again, it's another

buzzword, but when I'm speaking

to customers, I'm basically trying

to say, let's do cybersecurity.

But,

we need you to be cyber resilient

and when I say that, I try to

explain what that means, because

for me, and I want your opinion

on this and this is important.

Cybersecurity could be,

like you said, tools and

processes to just secure stuff.

When I talk cyber resilience,

it's more of a culture change.

It's more of you know,

understanding that the enterprise

and everyone involved and engaged

in the enterprise has to have

some kind of responsibility.

So are you talking cyber to

your customers and peers?

What does it mean to you?

Yeah.

I'm glad you brought that.

Cuz to be honest, the first time

you said it, you really annoyed

me because it kinda opened

up a whole another subject.

Oh oh, okay.

Now the truth's coming

You spot

on no, no hats off.

You're spot on.

Back in the day, hacking meant

like they stole your information.

You just had to recover from that.

Right now, a hack might be

either brick your server

or encrypt your data.

So how do you recover from that?

Well, you know, disaster recovery.

And so today you need to have

your backup system, which the

good news is those of us in IT.

They've been doing this since the

forties or fifties or sixties.

IT understands backup

and restoration.

Got it.

That's the good news.

Yeah.

But we've sort of

have raised the bar on them in

that we need to be more careful.

So we are now encrypting

the backups and we're

putting something on site.

The good news is again, good news

is that there's better tools.

A lot of the DR type products are

actually like a sand or something

that you can recover much, much,

much quicker back in the day, it

was rebuild the server and then

go off site and get the tapes

Right.

And restore the

tapes, which is the slowest

thing since watching paint dry.

Now it's, I need to

recover in an hour.

So we spin up a new VM, which,

you know, takes a minute.

And then this data storage

device that no one knew what

it was for now restores a

Terabyte, half a petabyte,

whatever X, wherever we are.

Yep.

So this backup

thing restores hundreds of

gigabytes in 15 minutes.

So it's changed, but I think

at least those of us who

are preoccupied with it.

I think we're in a good

place, because again, we

have this cool expensive high

performance backup system.

That's ready to go in minutes.

So that's

a great example.

I see.

Like when you say cyber resilience,

you wanna be able to recover.

I think recovering in any

situation is the bigger battle.

I mean getting attacked or

hacked and losing data is fine.

It was fine.

It's never fine, but

you know what I mean?

Like it happens, but now

if the organization is not

ready, doesn't have a plan.

That's where I see the shortcoming.

When you talk about resilience, can

we actually get back on our feet?

Right.

That's what I mean when I talk

about cyber resilience for me,

it's how quickly can you recover?

Can you really make those

objectives as an organization?

How long can you live being down?

What are the processes and steps

and solutions you have in place

to get you back up and running,

which you've just described.

So for me, that's the

differentiation between

cyber security and the

cyber resilient aspect.

That's the culture that I refer to

and maybe there's a better word.

Maybe there isn't.

But for me, that's kind of

the one that I've been using.

And if you think of a better

one, Mark, let me know, man.

No, I didn't like

it, but again, you're making

me think of things I don't

wanna think about LA LA LA.

Everything's fine.

Yeah

No,

I appreciate that.

No, it's good because again,

today what's the most likely

after they steal your data?

Encrypt it.

Yeah.

So right now that's

the standard or common attack.

So if I'm encrypted, I'm gonna

try and decrypted, I'm gonna

wipe it and start from scratch.

Yeah.

And it's funny

how we talk about days.

How many days to

recover or hours now?

It's minutes.

Yeah.

Yeah.

And

the tools are there.

Again, if you're in a normal shop,

you're gonna have a hypervisor.

And you're gonna spin up a

new servers and then you're

gonna restore the data locally.

In some ways well, we're okay.

And we can recover from an attack.

Obviously the goal for people

like us is to not get attacked.

Exactly.

But again, like you said, the

tool and the process and the

knowhow, that all comes together.

Right.

And a lot of companies

that I'm working with, they

haven't done a restore test.

They haven't done a

backup integrity check in

months, sometimes years.

It's just reality things.

Backing up is the easy part.

Do you know if it works, you know?

Funny

you say that yeah.

The big DR companies used

to make you do a DR test

and no, you're right.

The good news is IT is

used to doing backups,

backups, backups, backups.

And then, like you just said, when

was your last restoration test?

It gets really quiet.

Yeah.

Look, I'm just being honest.

You know what I mean?

Obviously, this is

what we do, right.

We walk into companies, we tell

'em, listen, this is what you need.

And more, more so than ever

when you're trying to apply

for a cyber insurance policy,

or you're trying to meet your

auditor's needs, they're asking

those questions regardless.

So we're just helping you

put those things in place.

So, Again, you can circumvent

it or you can just follow the

rules and do what you need

to do and just feel better

and sleep better at night.

That's kind of how we put it.

So I appreciate that.

And like I said, we still

have a long way to understand

or make the culture better

in all organizations.

But I think we are in the right

path from what I'm seeing.

I do have a really

sensitive question or

maybe a philosophical one.

But, there's a lot of ransomware

attacks happening right now.

There's a lot.

We see them every day in the news.

They're highly

visible in the media.

Companies can't hide from

these attacks anymore.

People find out about

them relatively quickly.

But some of the attacks that make

me very worried, are ones that

are on critical infrastructure.

The US has seen some over

the last couple of months

or the years and so on.

What's your thoughts on that?

Are we ready?

Are we not.

Again, this is philosophical one,

so you can answer if you want

to, but what are your thoughts

when it comes to ransomware

on critical US infrastructure

we're not ready.

The good news is I could tell

you from interviewing and meeting

people and things like that.

They're now aware of it.

Of course, colonial pipeline,

making the headlines help make it.

I think that the companies are

aware of it, but like everybody

else now it's just like somebody,

you know, you go to the doctor

and he says, you're an inch

away from a heart attack.

You're like, oh, oh, snap.

Now what?

Right.

So now they

gotta hire people and they are.

I would say they're

all in step one or two.

You know, what they tell

you, admitting you have a

problem is the first step.

So, so they're, they're

like the alcoholics,

it's a terrible analogy.

I'm sorry.

You know, they're admitting

there's a problem.

And now that needs to be

addressed and so I think we're

in a good place in that we're

moving forward, but are we

ready today for an attack?

Oh the heck, no, we're not ready.

So admitting

the problem exists, that's

the first step we got that.

Then of course, setting a path

and charting a path to mitigating

the risk and then having processes

and solutions in place then

in the event, it does happen.

Be able to bring them back quickly.

Yeah.

Yeah, absolutely.

Okay.

Yeah and just touching

a little bit on that.

I've seen it.

Obviously here in Canada as

well, we have these, you know,

huge, huge, companies who

provide infrastructure, whether

it be hydroelectric and so

on, the railways and so on.

For me, what worries me the

most is the OT/ IT split

where IT was traditional.

They know how to protect that.

And now there's the

operational technology

that's out there, which is,

Oh yeah.

You have

the gateway from the IP.

Right.

That's going into the operational.

And that to me has become, I

wouldn't say a mystery, but I

think that's where there's a lot of

uneasiness that's happening because

the OT tip typically

was kind of isolated.

It was kind of black boxed.

You couldn't get to it, and

now you have this connectivity

between the IP, which is

managing all these devices.

And that for me is something that

I think we need to get better at.

And I'm not sure there's

a lot of expertise in the

marketplace to do that right now.

There's some, but

it's like you know, the early

adopters are the guys, like

you, that are trying to sell the

solutions and that's all great.

That's all well and good.

I think, you're right back

in the day, it was some kind

of proprietary RS2, RS 422,

or RS 232 connectivity and

there's zone network now.

And I've seen them.

You've seen them.

It's smaller than your phone.

It's the size of a match book.

And it has some kind of

connector on it and then an

ethernet Jack, and I'm looking

at this, like, this is not good.

And so, yeah, no I have some kind

of water sensor, flood meters.

And that again, it's cute.

It's ethernet.

If my server room floods

this little, thing's

gonna send me a track.

Great.

But again, here's

this little thing.

It's running IP, which

means it has an OS.

No, I very much get it.

And I was just on a

call earlier today.

I said, start with segmenting.

First create an OT segment

first and foremost.

I've got some good

stories about that.

And what also bad.

You remember?

I think it was the target was the

hack through the air conditioner.

There you go.

We had a clock.

I'm not gonna say the names.

We had a clock vendor.

Where they had that the app was

in the cloud and they got hacked.

And it's very clear that they

were not doing zoning correctly

because they hacked the cloud.

They hacked the user, which

then hacked the cloud.

And then that cloud

was connected to me.

And so it's very clear that

people are saying, wow, we

gotta watch the OT thing.

And then they're slapping the

OT right on the production.

And I just cringe and wanna cry.

Yeah, I get it.

Even just so

you have its own segment,

like start with that.

Yeah.

Then we'll then

we'll worry about it later.

Yeah.

Segmenting your network is

definitely the first place you

wanna start when especially when

you have stuff that's unknown.

So ultimately you're

saying we're not ready.

And, I share that opinion because

I know there's a lot of stuff

that we haven't even thought

about when it comes to that.

So we touched a little

bit on skillset.

We touched a little

bit about the market.

Right now, what's your best

advice for companies dealing with

the staffing issues that we're

having and skillset shortages

specifically when it comes to

IT security, I'm seeing it.

I'm assuming you're seeing it too.

You wanna comment on that?

Two different things.

One is first and foremost, I think

every company larger than, I don't

know, some number thousand, 10,000,

2000 users needs a security guy.

Sorry, I'm from Jersey.

We say guy.

So every company bigger than X

should have a security person.

I don't mean a network

and, and, and no.

One guy, that's his only job.

That's their only job.

And so first you need one of

those, and then we get into okay,

that's where the shortage begins.

What business needs to do, the

big Googles, the big IBMs do it.

They have a training program

where they understand there's

a long haul and this was big

in the eighties and nineties.

And then they kind of died.

Now it's kind of coming back

with the Googles where you

say, okay, we're gonna hire

four analysts and willing full

well, two of 'em are gonna quit

and knowing full well, one of

'em may get promoted may not.

And we just need to

start at the bottom.

And at the bottom because of

time, it's say, alright, I'm

gonna hire four analysts.

And in two years I'm gonna

promote one or two of them.

And everyone corporate still,

I can't speak for Canada, but

corporate America still kind of

thinks this you're gonna take

the job and stay there forever.

Not if you're a smart,

ambitious engineer.

Yeah.

You're either gonna

leave to go down the street.

Or you're gonna stay and

get promoted and corporate

needs to say, all right,

I'm gonna hire four people.

And one of you will get promoted

in two years, 18 months,

and the hungry, ambitious,

smart, they'll get promoted.

And then now we've got

now a tier two person.

And then same way for every

two or three tier two.

One of those get promoted to

tier three and corporate needs

to say, we're gonna have a flow.

We want you to stay.

And if you're our guy, you're gonna

move from tier one to two to three.

And certain amounts of time

based on benchmarks, the service

providers are kind of good at that.

And I say kind of, because

they're more forced

into it's the same boat,

Right, yeah.

In a year or two,

the people that are young and

ambitious, ambitious, meaning

money are gonna quit for more

pay and corporate will say, well,

we don't wanna train the guy.

And then he leaves.

And I'm like, if you don't train

him, he's gonna leave anyway.

Right.

Exactly.

There's a saying where, what if

you train him and they leave,

well, what if you don't train

him and they stay that's just as

Right.

No, no.

I love that one.

I'm like, and everybody stares

at you, you're like, well,

Yeah, yeah, yeah.

We need to go back

to, you know, kind of the old days

of saying, I'm gonna care and feed

meaning I'm gonna hire these four.

And I shouldn't say young cuz I'm

not, you know, less experienced

people that you're gonna grow.

And yes, half of 'em will quit.

Half of those half you'll wanna

quit cuz they're not your type

of people and that's okay.

That's okay.

But again, we

need to hire four people with a

full understanding that you'll

be lucky to keep two of em.

So along that line,

like for us when I'm talking to

clients and they're all looking

for cyber experts and looking for

infrastructure people, for me,

what I basically say is, okay,

well, prioritize your projects.

Gimme a list of your projects.

Because you're not gonna just

develop staff or skillset

overnight, the market is really

such is drained right now.

There's not a lot of

people in the market.

We know that.

There's a lot of

risk because of that.

There's a lot of bad actors

that take advantage of this.

There's not a lot of people

watching your enterprise,

then you could be at risk.

So what I'm basically telling

customers is, give me a list

of your projects for the next

12 months, 18 months, and

let just prioritize them and

hoping 60% of those projects

are in the security space.

Really.

I really hope just because,

I mean, if you leave the door

open, people are gonna come in.

You know what I mean?

That's kind of how I see it.

I mean, there's no

other way to go around.

The good news

is boards are expanding.

I've talked to lots of people.

I met this awesome CISO.

And she's like, in her first,

I don't know, month she's like,

I got the board to quadruple my

budget and I almost fainted.

I'm like, I would've settled

for double, but she's

like, no, I quadrupled it.

She's good at

selling her business case.

That's great.

She's good.

Yeah, I very much

wanted to work for her.

It didn't work out that's okay.

But anyway, it's boards are

spending money, but again,

now we're back to, okay.

So if I give you a whole bunch

of money and I tell you to go

hire three people, I'm gonna

come back in three months

and say, how's it going?

You're gonna tell me not so great.

So half the advice I have

brings back to hire more people.

Oh yeah.

There are more people to

hire we're in this wheel.

That's

to my point, right?

Let's look at your projects

and then let's be realistic on

which ones can be delivered and

which ones need to be delivered.

And because there's not gonna

be more staff coming and that's

why I'm always asking that

question to anyone I speak

about the IT shortages, and

then I'm hoping that we're gonna

see more people in the field.

But, I mean, I'll

be honest with you.

I'm a little bit pessimistic

when it comes to that

cause I'm not seeing a lot of up

and coming individuals in their

early twenties who are looking

at IT as an attractive place.

I wish there were would

be more, but right now

it's kind of difficult.

I wanna be the

optimist and disagree with

you, but I'm not, I got Zippo.

Well, again, that's

why we're so busy I guess.

I feel like we

just need to do a grassroots.

It doesn't help us.

I'll be retired by the time

this plan goods through, but we

need to go to the young people.

My kids, and they were

like, Ooh, that's geeky,

like, Ooh, dirty geeky.

And I'm like, You

know, look at my car.

I got a nice car.

I paid for that.

I'm telling my own kids be

a geek and they go, yeah,

dad, we know you're a geek.

It's a

good place to be in.

It's a great career.

You get to work with smart people.

You're not

cool, but you could buy a much

cooler car than the cool guy.

So come on buddy.

We should

start a podcast on how

to recruit young talent.

Dude, you

pull up in that that Audi or

that TransAm or whatever the

hot young person's car is.

Hopefully it's not a Prius, but

you pull up in the cool car.

People will just

assume you're cool.

I get it

works for me.

I get it.

Yeah.

Yeah.

But TransAm, hasn't been

out there for a while so

that's dating ourselves.

Dating myself Camaro.

It still is

cool though for some people

I'll have to be honest.

Hey you know,

try pull up on a McLaren

there you go.

Think

we're gonna be like, yes.

Cool.

You're

right about that.

And it is a career where

you can achieve it.

That's what people are

gonna underestimate.

So look, we're doing

well with time, but I

wanna respect your time.

So I've got a couple minutes here.

I have one last question, which

I think we just touched on.

So when it comes to the state

of affairs, a cyber security

in terms of getting companies,

getting compromised or breached.

Let's be honest here.

Are things gonna get worse

before they get better.

Or are we on the

road to success here?

That's

a great question.

I wish I had that crystal ball,

but I would say they're gonna

stay where they are because

companies can today go buy a

good EDR endpoint detection.

You can go buy today, a good

endpoint and have it managed.

A lot of those software makers

are providing protection.

If you have no people, but

you got a couple of box.

Anybody can go buy good

EDR and have it managed.

That is a big part of it.

I think that'll go a long way.

I think it's gonna be about

the same as it is today.

And it's gonna take a while

to get better because they're

just gonna, you know, OT, let's

say we secure all the PCs and

my PCs are actually secured.

Okay.

What's next OT.

You already said it.

It's already there, so, okay.

My PCs are safe, but

my OTs and channels.

So you're saying

we're flattening out now.

Should we have seen the worst?

I think let's

call it a quality X today.

I think we're gonna stay at this

quality X for at least two years.

Well, that's good.

I mean it's obviously

more optimistic.

Well, it's more optimistic than I

would've been, to be honest with

you cuz I still see, we have some

challenges in the enterprise, but

I am seeing a lot more awareness.

Right?

So the awareness is good,

which is the fundamental

way to change things.

So if awareness is there and people

start engaging and taking a more

responsible role in the day to

day, I think we should be better.

But again, the only variable

there is that there's a lot

more bad actors in the market.

So there's more people out there

trying to make your day worse.

Oh yeah.

I don't wanna say one

of the big emails.

Like every day, they make

it easy for the bad actors

to set up an account.

So a bad actor can set up a Gmail

ID of a GM 1 23 with a name Mark,

you know, with my name on it.

And so when you get an

email that says my name on

it, and you're like, oh,

Mark, sending me an email.

It's not, it's the bad actor, so.

There's some stuff that's

still so easy, but you have to

be cynical about any emails.

There was a group, this one

came in the guy had used

someone else's LinkedIn.

And he was like reaching out

to people like his old friends.

It's possible that, you know, if

you're less cynical, you're like,

oh, I think I remember a Bob.

Yeah.

Bob's something, you know,

Hey Luigi, remember when you

and I worked at Verizon and

you'll be like, yeah, there

was like, please, there were a

hundred thousand people there.

So it's still a challenge.

We raise awareness, people say it,

and I'm hoping that they're scared

enough to not just click away.

If we're scared of anything,

it's just don't click without.

I agree with you.

Before we wrap up here to your last

point, like, know the difference

between spam and an actual

phishing email, that's important.

That's for sure.

I know this is spam.

Then the gift cards.

Oh my Lord.

Every week.

Hey, from the CEO, Dave.

Hey, so and so pick up some

gift cards for the team.

And it was so funny.

I never laughed so hard.

The directors that knew my

CEO said this guy's a cheap

SOB and there's no way he's

buying gift cards for the team.

You didn't

have to validate that.

I just laughed.

I'm like, okay, whatever works.

That was fun.

Good times.

Mark.

Before we wrap up do you

have any questions for me?

Is there a good

target market for you in terms

of who you're dealing with?

Is it more the midsize?

Yeah, it's tricky

cause in midsize in Canada versus

US midmarket is a little different.

So our large enterprise

ends up being your

midmarket there in the US.

Kind of right.

Here at Assurance IT we typically

deal with the mid-market companies,

anything to do from, I'd say

250 employees to 3000 employees.

It's a wide sweet spot, but it's

a good sweet spot because going

back to your point earlier,

there's a lot of need there.

There's a lot of

requirements there.

Some companies have

grown tremendously.

They got a whole bunch of new

employees on staff and they

just haven't been able to keep

up with the security demands.

I've worked in large

enterprise myself before.

I enjoy it.

The only thing I can say is,

without knocking anyone, there

are longer cycles to get things

done sometimes, you know?

So, I mean, again, it's

just a matter of cycles.

Budgets come in and you have

to go ahead and they have to

deliver a project and so on.

But we find that in the midmarket

space where companies need

to react quicker, they have

less layers of management.

They're a lot more nimble.

They see a need, they

go get budget approval.

Business cases are

approved a lot quicker.

And then we move.

So that's who our targets are.

We're seeing a lot of success

in there and we attribute a

lot of process into the game.

It's great that you throw a tool

at it, of course, but you have to

also have a process to make sure

that, business continuity only

plans, make sure that you've got

an awareness program in place.

And what are you

doing to measure that?

Those are all things that

companies kind of forget

when they install a tool.

So tools, processes, and people.

It's very important.

No,

you're spot on spot on.

Well, Mark,

any other questions?

No, no, no.

I just was gonna throw out some

crazy idea, but that's what we're

go ahead.

What's the crazy idea, man?

Dismiss

these frameworks.

I very much appreciate what

they're doing, but, I got a

crazy thought listening to you

cuz you inspire thought Luigi.

Yeah.

That's that's a quite,

quite high praise.

Cuz I'm working on NIST and I

like NIST in that it's plain.

Like I get it 90 days

for password expiration.

Okay.

I know what that means.

I know what to do about it.

It's easy.

But it's also 140 checkboxes.

That's a lot of checkboxes.

I think maybe the industry

should push for like a NIST

light, kind of like, first

grade, if you can get to this

first level, you're not perfect.

You're not a defense

contractor level, but

you're at least somewhere.

Yes.

And so

that would be like spam.

And the good news is you can

get a spam service and an EDR

service and a web hosting service.

I'm seeing web hosting companies

offer managed WAF that as

part of managing the app.

I'm like, okay, now we're talking.

I mean, I know you gotta pay for

it obviously, but versus hiring

a WAF person, not happening.

So if I can buy a server hosting

along with the whole WAF layer.

There you go.

Yeah.

Mark, that's a very good point.

So what we do is, again, some of

the companies just don't have the

exhaustive time or the effort to go

through these weeks or month long

situations where they have to

go through frameworks and so on.

We leverage very often in Canada,

we have what we call cyber secure

Canada, which essentially is

like 13 controls that, they're

published, they're online.

Easy to read, easy to consume.

Anyone can understand them.

And they're 13 security

controls that are well aligned

with a lot of the frameworks

out there already today.

They also align with what the cyber

insurance companies are asking for.

So when a customer comes to me

and says, well, where do I start?

I said, well, you can't go wrong

by looking at these 13 points.

Start with these.

Do your self-assessment, you

know, what are you doing today?

Are you doing MFA?

Are you doing the

education awareness?

Are you doing the backup?

And then if you're not like,

at least it doesn't come off

as if I'm trying to push you

something, it's a self-assessment

that you can easily do yourself.

And from there we say,

okay, where's the gap?

What are you missing?

Let's go and fill those gaps.

So I agree with you.

I mean, there's a lot of

frameworks out there and sometimes

are overwhelming for people.

So if an organization can

self-assess themselves, It's a

great start that way, it's coming

from themselves versus someone

else externally, and it's a way

of keeping yourself honest and

do that on a yearly, you know,

just make sure on a yearly basis,

you're keeping up with that.

Cause again, if you don't have

enough staff to go through all

those processes, make sure there's

someone there, like you said,

that individual, that responsible,

that can self-assess themselves.

Yep.

I like it.

Well good.

Listen, mark.

This has been fantastic.

I really appreciate going

back and forth here.

Absolutely, man.

You inspire thought, dude,

you're making me think

I'm

gonna remember that.

I gotta tell my family that one.

Sometimes

things I don't wanna think

about, but that's, you know,

that's what

we're for, we gotta keep

ourselves on our toes.